Demurrer

California's Supreme Court reversed a lower court's revival of a class action lawsuit over a data breach at Illuminate Education, Inc., holding on May 14, 2026 that the education software company did not qualify as a "business associate" under California's medical-privacy law framework. The plaintiff, an 11-year-old student represented by guardian ad litem Jean Paul Magallanes, had alleged that Illuminate negligently failed to protect confidential student and medical information after hackers accessed the company's systems. The case began with the initial breach, proceeded through dismissal on demurrer, and was revived by the Court of Appeal in 2024 before reaching the state's highest court.